CVE-2026-84333: Google Chrome Dawn Use After Free Vulnerability

CVE-2026-84333 Overview

CVE-2026-84333 is a use-after-free vulnerability in the Dawn component of Google Chrome on Android. Dawn is Chrome's implementation of the WebGPU standard, which exposes GPU functionality to web content. A remote attacker can exploit the flaw by serving a crafted HTML page, triggering memory corruption that leads to arbitrary code execution outside the Chrome sandbox. The issue affects Chrome for Android versions prior to 152.0.7977.75. Because the attack escapes the renderer sandbox, successful exploitation grants the attacker code execution at the browser process privilege level on the device.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox on Android devices by luring users to a malicious web page.

Affected Products

Google Chrome for Android prior to 152.0.7977.75
Dawn WebGPU implementation shipped with vulnerable Chrome builds
Chromium-based Android browsers embedding the affected Dawn version

Discovery Timeline

2026-09-02 - CVE-2026-84333 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84333

Vulnerability Analysis

The vulnerability is a use-after-free ([CWE-416]) in Dawn, the native implementation backing the WebGPU API in Chrome. Use-after-free defects occur when code continues to reference an object after its backing memory has been released. In Dawn, GPU resource lifetimes are managed across renderer and GPU processes, and lifetime tracking errors between JavaScript-visible objects and native GPU allocations can leave dangling pointers reachable from web content.

An attacker who reclaims the freed allocation with attacker-controlled data can hijack virtual function pointers or command buffers processed by Dawn. Because Dawn code executes in the GPU process, which has broader capabilities than the renderer sandbox, successful memory corruption escapes the standard site-isolation boundary.

Root Cause

The root cause is improper object lifetime management inside Dawn's WebGPU resource handling on Android. A JavaScript sequence exposed through the WebGPU API frees an underlying GPU object while another code path retains and later dereferences the stale pointer. Details are tracked in Chromium Issue Tracker #549311485.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page with WebGPU enabled. The page issues a targeted sequence of WebGPU calls that trigger the use-after-free in Dawn, then sprays the freed slot with controlled data. Once the dangling pointer is reused, the attacker gains code execution in the GPU process, bypassing the Chrome renderer sandbox on Android. No authentication is required, but user interaction to load the page is necessary.

No verified public proof-of-concept is available. See the Chromium Issue Tracker entry for technical details once access restrictions are lifted.

Detection Methods for CVE-2026-84333

Indicators of Compromise

Unexpected crashes or restarts of the Chrome GPU process on Android devices, particularly on pages using WebGPU.
Outbound connections from mobile devices to unfamiliar domains immediately after browsing sessions.
Chrome browser versions on Android reporting a build older than 152.0.7977.75 in enterprise inventory.

Detection Strategies

Inventory installed Chrome versions across managed Android endpoints and flag any build below 152.0.7977.75.
Monitor mobile device management (MDM) telemetry for browser crash reports that reference dawn or GPU process termination.
Correlate web proxy logs for repeat access to pages serving WebGPU shader payloads from low-reputation domains.

Monitoring Recommendations

Enforce Chrome auto-update policies through Google Play managed configurations and alert on non-compliant devices.
Ingest browser crash and update telemetry into a centralized analytics platform for version-drift detection.
Track network egress from mobile fleets for anomalous post-browsing beaconing patterns.

How to Mitigate CVE-2026-84333

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.75 or later through the Google Play Store.
Push an urgent update policy via MDM to accelerate patch rollout to all managed Android endpoints.
Restrict browsing to trusted sites on unpatched devices until updates are confirmed.

Patch Information

Google addressed the vulnerability in Chrome 152.0.7977.75 for Android. Patch details are announced in the Google Chrome Stable Channel Update. Users should verify the Chrome version under Settings > About Chrome after updating.

Workarounds

Disable WebGPU on managed Chrome installations by setting the WebGPU enterprise policy to disabled until patching is complete.
Block access to untrusted external websites through mobile web filtering while the fleet is updated.
Use Google Play managed configurations to enforce automatic Chrome updates on all corporate Android devices.

bash

# Enterprise policy example: disable WebGPU on managed Chrome for Android
# Deploy via Android Enterprise managed configurations for com.android.chrome
{
  "WebGPUEnabled": false,
  "DefaultJavaScriptJitSetting": 2
}